Ravens PHP Scripts - Mozilla Firefox Wizz RSS News Reader Extension Cross-Context Scripting

SECUNIA ADVISORY ID: SA24913

VERIFY ADVISORY: http://secunia.com/advisories/24913/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Wizz RSS News Reader (Extension for Mozilla Firefox) 2.x - http://secunia.com/product/13955/

DESCRIPTION: A vulnerability has been reported in the Wizz RSS News Reader extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.

Certain input is not properly sanitised before being used and can be exploited to e.g. execute arbitrary script code within the "chrome:" context. Successful exploitation requires that a user is tricked into loading a specially crafted RSS feed. The vulnerability is reported in versions prior to 2.1.9.

SOLUTION: Update to version 2.1.9. - https://addons.mozilla.org/en-US/firefox/addon/424

PROVIDED AND/OR DISCOVERED BY: The vendor credits Jefferson Ogata, NOAA Computer Incident Response Team.

ORIGINAL ADVISORY: Wizz RSS News Reader: - https://addons.mozilla.org/en-US/firefox/addon/424

OTHER REFERENCES: US-CERT VU#319464: http://www.kb.cert.org/vuls/id/319464